pi-lens 4.4.1 → 4.4.2

package/dist/{chunk-IQZXOZ7S.js → chunk-ESBQHFMJ.js}

@@ -4,15 +4,15 @@ import {
   detectPythonEnvironment,
   detectPythonVenv,
   pythonEnvironmentToolCandidates
-} from "./chunk-LNOMA3MP.js";
+} from "./chunk-34WSVGEM.js";
 import {
   resolveOpengrepConfig
-} from "./chunk-U52SAGRM.js";
+} from "./chunk-VWCXW2E7.js";
 import {
   extensionsForLanguage,
   getUserRuleRoot,
   ruleCorpusFingerprintForCycle
-} from "./chunk-KJCWXUUS.js";
+} from "./chunk-724UL2TJ.js";
 import {
   load,
   resolvePackagePath
@@ -22,11 +22,11 @@ import {
   readCargoWorkspaceExclude,
   readCargoWorkspaceMembers,
   readTextFileOrUndefined
-} from "./chunk-S6AMWKPC.js";
+} from "./chunk-P7266HLM.js";
 import {
   HOOK_WALL_BUDGET_MS,
   bounded
-} from "./chunk-F5VLZHUW.js";
+} from "./chunk-52FUZI6K.js";
 import {
   ensureTool,
   findManagedToolBinary,
@@ -36,20 +36,21 @@ import {
   isZizmorAuditTarget,
   logSessionStart,
   resolveZizmorGitHubToken
-} from "./chunk-LD7WFTRX.js";
+} from "./chunk-66VMUL7Q.js";
 import {
   resolveToolCwd
-} from "./chunk-IUR76K6A.js";
+} from "./chunk-Q7DUK4LX.js";
 import {
-  findGlobalBinary
-} from "./chunk-T4QZ6FEH.js";
+  findGlobalBinary,
+  isProjectLocalBinPath
+} from "./chunk-AW7R2GWG.js";
 import {
   classifyProbeFailure,
   createAvailabilityLatch,
   describeInstallAttempt,
   logAvailabilityDecision,
   startHostStallSampler
-} from "./chunk-O7HZX7CA.js";
+} from "./chunk-VRZP76YM.js";
 import {
   OWNER_TAG_ENV,
   SpawnFailureError,
@@ -63,21 +64,25 @@ import {
   isCommandAvailableAsync,
   isPathIgnoredByProject,
   ownerTagForChildren,
+  resolveWindowsCommandForEnvironment,
   safeSpawnAsync
-} from "./chunk-T54VJRAD.js";
+} from "./chunk-C34ZXZ7O.js";
 import {
   DOTNET_CSHARP_ROOT_MARKERS,
   DOTNET_FSHARP_ROOT_MARKERS,
-  KIND_EXTENSIONS
-} from "./chunk-64LU2OVH.js";
+  KIND_EXTENSIONS,
+  LEAN_ROOT_MARKERS
+} from "./chunk-PHDMFAKM.js";
 import {
+  isRepoTier,
   lspSectionOf,
   migrationSubject,
+  provenanceFor,
   reportConfigReadFailure,
   reportPiLensConfigRecords,
   resolvePiLensConfig,
   summarizeConfigResolution
-} from "./chunk-N2IRDBZI.js";
+} from "./chunk-2BBLFX75.js";
 import {
   FRESHNESS_CADENCE_MS,
   LSP_NAMESPACE_KEY,
@@ -85,23 +90,30 @@ import {
   dirMtimesStillFreshAsync,
   getPiLensGlobalConfigPath,
   unknownDirMtimeRecords
-} from "./chunk-Z6BB4JLQ.js";
+} from "./chunk-XVF2VVXP.js";
 import {
+  getProjectTrustState
+} from "./chunk-ZANLILYD.js";
+import {
+  getDegradationLedgerGeneration,
   incrementDegradationCount,
   recordDegradationOnce
-} from "./chunk-7ELY2CSM.js";
+} from "./chunk-JAU72XNY.js";
+import {
+  logExtension
+} from "./chunk-XTMJ7XDT.js";
 import {
   claimPhaseOncePerSession,
   currentSessionRecordId,
   logLatency,
   releasePhaseClaim
-} from "./chunk-3PNFWVHT.js";
+} from "./chunk-QQNQ7SJW.js";
 import {
   getGlobalPiLensLogDir,
   getProcessSingleton,
   isTestMode,
   redactSecrets
-} from "./chunk-VSMJK3ZJ.js";
+} from "./chunk-AOHZU2BM.js";
 import {
   STAGE_TMP_PATTERN
 } from "./chunk-LJDODBBZ.js";
@@ -115,6 +127,7 @@ import {
   findLocalToolConfig,
   isAtOrAboveHomeDir,
   isFullyQualified,
+  isUnderDir,
   isWindowsPath,
   matchesWorkspaceMemberPattern,
   normalizeEphemeralMapKey,
@@ -122,51 +135,16 @@ import {
   normalizeMapKey,
   pathsEqual,
   toPosix
-} from "./chunk-G3RLJYA2.js";
+} from "./chunk-N2H3ZPZY.js";
 import {
   __require
 } from "./chunk-NXL4FFQQ.js";
 
-// dist/clients/lsp/server-traits.js
-var ROLE_MEMBERS = {
-  language: "language",
-  auxiliary: "auxiliary"
-};
-var DEFAULT_LSP_SERVER_ROLE = "language";
-function isAuxiliary(bearer) {
-  const declared = bearer?.role;
-  const role = typeof declared === "string" && Object.hasOwn(ROLE_MEMBERS, declared) ? ROLE_MEMBERS[declared] : DEFAULT_LSP_SERVER_ROLE;
-  switch (role) {
-    case "auxiliary":
-      return true;
-    case "language":
-      return false;
-  }
-}
-var DEFAULT_NOTIFY_INFLIGHT_LIMIT = 8;
-var DEFAULT_REPLY_ORDERING = "unmeasured";
-function serverTraits(declaration) {
-  const declaredLimit = declaration.notifyInflightLimit;
-  if (typeof declaredLimit === "number" && Number.isFinite(declaredLimit) && declaredLimit > 0) {
-    return {
-      role: declaration.role,
-      notifyInflightLimit: Math.floor(declaredLimit),
-      replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
-    };
-  }
-  const envLimit = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
-  return {
-    role: declaration.role,
-    notifyInflightLimit: Number.isFinite(envLimit) && envLimit > 0 ? Math.floor(envLimit) : DEFAULT_NOTIFY_INFLIGHT_LIMIT,
-    replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
-  };
-}
-
 // dist/clients/lsp/server.js
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, statSync as statSync3 } from "node:fs";
 import { access, readFile, readdir, stat } from "node:fs/promises";
 import os6 from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 
 // dist/clients/sgconfig.js
 import { createHash } from "node:crypto";
@@ -478,9 +456,44 @@ function findLocalTyposConfig(startDir) {
   return findLocalToolConfig(startDir, LOCAL_TYPOS_CONFIG_NAMES);
 }
 
+// dist/clients/lsp/server-traits.js
+var ROLE_MEMBERS = {
+  language: "language",
+  auxiliary: "auxiliary"
+};
+var DEFAULT_LSP_SERVER_ROLE = "language";
+function isAuxiliary(bearer) {
+  const declared = bearer?.role;
+  const role = typeof declared === "string" && Object.hasOwn(ROLE_MEMBERS, declared) ? ROLE_MEMBERS[declared] : DEFAULT_LSP_SERVER_ROLE;
+  switch (role) {
+    case "auxiliary":
+      return true;
+    case "language":
+      return false;
+  }
+}
+var DEFAULT_NOTIFY_INFLIGHT_LIMIT = 8;
+var DEFAULT_REPLY_ORDERING = "unmeasured";
+function serverTraits(declaration) {
+  const declaredLimit = declaration.notifyInflightLimit;
+  if (typeof declaredLimit === "number" && Number.isFinite(declaredLimit) && declaredLimit > 0) {
+    return {
+      role: declaration.role,
+      notifyInflightLimit: Math.floor(declaredLimit),
+      replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+    };
+  }
+  const envLimit = Number(process.env.PI_LENS_LSP_AUX_NOTIFY_INFLIGHT);
+  return {
+    role: declaration.role,
+    notifyInflightLimit: Number.isFinite(envLimit) && envLimit > 0 ? Math.floor(envLimit) : DEFAULT_NOTIFY_INFLIGHT_LIMIT,
+    replyOrdering: declaration.replyOrdering ?? DEFAULT_REPLY_ORDERING
+  };
+}
+
 // dist/clients/lsp/config.js
 import * as os3 from "node:os";
-import path4 from "node:path";
+import path3 from "node:path";
 
 // dist/clients/dispatch/known-runner-ids.js
 var knownRunnerIds = /* @__PURE__ */ new Set();
@@ -495,6 +508,7 @@ function isKnownRunnerId(id) {
 }
 
 // dist/clients/lsp/launch.js
+import { AsyncLocalStorage } from "node:async_hooks";
 import { execFileSync, spawn as nodeSpawn } from "node:child_process";
 import fs3 from "node:fs";
 import os2 from "node:os";
@@ -689,6 +703,16 @@ function isCmdShimValid(cmdPath) {
     return true;
   }
 }
+function isMissingWindowsStartupCommand(command, spawnCommand, cwd, env) {
+  if (!isWindows)
+    return false;
+  if (/\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
+    return true;
+  }
+  if (spawnCommand !== command)
+    return false;
+  return resolveWindowsCommandForEnvironment(command, cwd, env) === null;
+}
 function bypassPs1OnWindows(ps1Path, args) {
   const cmdPath = `${ps1Path.slice(0, -4)}.cmd`;
   if (fs3.existsSync(cmdPath)) {
@@ -736,6 +760,65 @@ function findBinaryOnPath(command, env) {
   }
   return void 0;
 }
+var lspProjectCodePermission = new AsyncLocalStorage();
+function withLspProjectCodePermission(allowed, spawn) {
+  return lspProjectCodePermission.run(allowed, spawn);
+}
+var unknownProjectLocalNoticeGeneration = -1;
+function recordUntrustedLspExecution(request, trust) {
+  const generation = getDegradationLedgerGeneration();
+  const subject = request.kind === "project-code-server" ? `project-code-server:g${generation}:${request.serverId}:${request.root}` : `project-local-binary:g${generation}:${path2.basename(request.command)}`;
+  const metadata = request.kind === "project-code-server" ? {
+    field: request.kind,
+    serverId: request.serverId,
+    root: request.root,
+    trust
+  } : {
+    field: request.kind,
+    trust
+  };
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason: (request.kind === "project-local-binary" ? request.reason : void 0) ?? `LSP execution refused: ${request.kind} and project trust is ${trust}`,
+    metadata
+  });
+  if (unknownProjectLocalNoticeGeneration !== generation) {
+    unknownProjectLocalNoticeGeneration = generation;
+    const label = request.kind === "project-code-server" ? "project-code LSP server" : "project-local LSP binary";
+    logExtension({
+      subsystem: "lsp-registry",
+      level: "warn",
+      message: `${label} refused: mark the project trusted in pi or upgrade pi`,
+      metadata: { field: request.kind }
+    });
+  }
+}
+function refuseUntrustedLspExecution(request) {
+  const trust = getProjectTrustState();
+  const needsTrust = request.kind === "project-code-server" ? trust !== "trusted" : !admitProjectSuppliedTsserver(request.resolvedCommand, request.cwd, true);
+  if (!needsTrust)
+    return;
+  if (request.kind === "project-code-server")
+    recordUntrustedLspExecution(request, trust);
+  throw new SpawnFailureError("spawn-failed", `LSP ${request.kind === "project-code-server" ? "project-code server" : "project-local binary"} refused: project trust is ${trust}`, new Error(`project trust is ${trust}`));
+}
+function admitProjectSuppliedTsserver(tsserverPath, cwd, projectSupplied, projectCodeAllowed = lspProjectCodePermission.getStore() ?? false) {
+  const trust = getProjectTrustState();
+  if (tsserverPath && (!projectSupplied || projectCodeAllowed && trust === "trusted"))
+    return tsserverPath;
+  recordUntrustedLspExecution({
+    kind: "project-local-binary",
+    command: tsserverPath ?? "tsserver.js",
+    resolvedCommand: tsserverPath ?? "tsserver.js",
+    cwd,
+    reason: tsserverPath ? "LSP execution refused: project compiler requires trusted session ownership" : "LSP execution refused: no admitted absolute TypeScript compiler"
+  }, trust);
+  return void 0;
+}
+function isProjectLocalLspBinary(resolvedCommand, cwd) {
+  return isProjectLocalBinPath(resolvedCommand, cwd);
+}
 function trySpawn(command, args, cwd, env, needsShell) {
   let proc;
   if (needsShell) {
@@ -764,9 +847,6 @@ function trySpawn(command, args, cwd, env, needsShell) {
   if (!proc.stdin || !proc.stdout || !proc.stderr) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
-  if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
-  }
   holdOwnChildPid(proc.pid, "lsp-spawn");
   return proc;
 }
@@ -842,6 +922,14 @@ async function launchLSP(command, args = [], options = {}) {
       needsShell = computeNeedsShell(spawnCommand);
     }
   }
+  if (isProjectLocalLspBinary(spawnCommand, cwd)) {
+    refuseUntrustedLspExecution({
+      kind: "project-local-binary",
+      command,
+      resolvedCommand: spawnCommand,
+      cwd
+    });
+  }
   if (isWindows && /\.(cmd|bat)$/i.test(spawnCommand) && !isCmdShimValid(spawnCommand)) {
     logSessionStart2(`lsp cmd-shim-invalid: ${spawnCommand} target missing \u2014 skipping candidate`);
     const cause = Object.assign(new Error(`LSP .cmd shim target not found: ${spawnCommand}`), { code: "ENOENT" });
@@ -878,7 +966,12 @@ async function launchLSP(command, args = [], options = {}) {
     throw new Error(`Failed to spawn LSP server: ${command}`);
   }
   if (proc.exitCode !== null || proc.killed) {
-    throw new Error(`LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`);
+    const message = `LSP server ${command} exited immediately (code: ${proc.exitCode}). The binary may be missing or corrupted.`;
+    const failure = new Error(message);
+    if (proc.exitCode === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+      throw new SpawnFailureError("tool-not-found", message, failure);
+    }
+    throw failure;
   }
   logSessionStart2(`lsp launch: command=${command} resolved=${spawnCommand} args=${JSON.stringify(args)} cwd=${cwd} shell=${needsShell ? "true" : "false"} pid=${proc.pid ?? 0}`);
   const formatStartupStderr = (stderr) => {
@@ -911,7 +1004,13 @@ async function launchLSP(command, args = [], options = {}) {
           settled = true;
           const isWindowsCmd = isWindows && command.endsWith(".cmd");
           const errorMsg = isWindowsCmd && code === 1 ? `npm .cmd shim failed (underlying binary not installed). Run 'npm install' in this project or use a global installation.` : `The binary may be missing or corrupted.`;
-          reject(new Error(`LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`));
+          const message = `LSP server ${command} exited immediately with code ${code}. ${errorMsg}${formatStartupStderr(startupStderr)}`;
+          const failure = new Error(message);
+          if (code === 1 && isMissingWindowsStartupCommand(command, spawnCommand, cwd, env)) {
+            reject(new SpawnFailureError("tool-not-found", message, failure));
+            return;
+          }
+          reject(failure);
         }
       });
       const startupFailureWindowMs = (() => {
@@ -951,61 +1050,13 @@ async function launchLSP(command, args = [], options = {}) {
   };
 }
 
-// dist/clients/lsp/session-roots.js
-import path3 from "node:path";
-var SESSION_ROOT_CAP = 128;
-var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
-function noteEvictedRoots(evicted) {
-  const roots = evicted.map(([root]) => root);
-  if (roots.length > 0) {
-    incrementDegradationCount({
-      kind: "lsp-session-root-evicted",
-      subject: `cap=${SESSION_ROOT_CAP}`,
-      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
-    });
-  }
-  return roots;
-}
-function registerSessionRoot(cwd) {
-  const root = path3.resolve(cwd);
-  if (sessionRoots.has(root))
-    return [];
-  return noteEvictedRoots(sessionRoots.set(root, void 0));
-}
-function setSessionRootConfig(cwd, config) {
-  return noteEvictedRoots(sessionRoots.set(path3.resolve(cwd), config));
-}
-function sessionRootConfigEntries() {
-  return sessionRoots;
-}
-function isSessionRootRegistered(cwd) {
-  return sessionRoots.has(path3.resolve(cwd));
-}
-function shouldInitializeSessionRoot(cwd, readyRoots) {
-  const normalized = path3.resolve(cwd);
-  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
-}
-function isOutsideAllSessionRoots(filePath) {
-  if (sessionRoots.size === 0)
-    return false;
-  const resolved = path3.resolve(filePath);
-  for (const root of sessionRoots.keys()) {
-    if (isSameOrWithin(root, resolved))
-      return false;
-  }
-  return true;
-}
-function getSessionRootsForTelemetry(limit = 4) {
-  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
-}
-
 // dist/clients/lsp/config.js
 function asRecord(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 var CONFIG_RESOLVED_PHASE = "config_resolved";
 function configResolutionKey(cwd) {
-  return normalizeFilePath(path4.resolve(normalizeFilePath(cwd)));
+  return normalizeFilePath(path3.resolve(normalizeFilePath(cwd)));
 }
 function publishConfigResolutionPending(cwd) {
   logSessionStart(`session_start config_resolution_pending session=${currentSessionRecordId()} root=${configResolutionKey(cwd)}`);
@@ -1061,6 +1112,10 @@ async function loadLSPConfig(cwd, homeDir = os3.homedir(), options = {}) {
   });
   const coversProblems = newCoversClaimProblems();
   const config = lspConfigOf(resolution.value, coversProblems);
+  Object.defineProperty(config, "__provenance", {
+    value: resolution.provenance,
+    enumerable: false
+  });
   if (reporting) {
     reportPiLensConfigRecords([
       ...resolution.records,
@@ -1158,7 +1213,7 @@ function customServerSpecsOf(value) {
   const servers = asRecord(lspSectionOf(value).servers);
   return servers ? coversValidatedServers(servers) : {};
 }
-function lspConfigOf(value, problems) {
+function lspConfigOf(value, problems, provenance) {
   const section = lspSectionOf(value);
   const config = {};
   const servers = asRecord(section.servers);
@@ -1174,6 +1229,12 @@ function lspConfigOf(value, problems) {
   if (Array.isArray(section.warmFiles)) {
     config.warmFiles = section.warmFiles;
   }
+  if (provenance) {
+    Object.defineProperty(config, "__provenance", {
+      value: provenance,
+      enumerable: false
+    });
+  }
   return config;
 }
 function createCustomServer(config, id) {
@@ -1209,26 +1270,74 @@ function createCustomServer(config, id) {
         cwd: root,
         env: config.env ? { ...process.env, ...config.env } : process.env
       });
-      return { process: proc };
+      return {
+        process: proc,
+        ...config.initializationOptions ? { initialization: config.initializationOptions } : {}
+      };
     }
   };
 }
 var EMPTY_CONFIG = {
   customServers: [],
+  // Avoid reading LSP_SERVERS during the config/server module cycle. The
+  // selection helper falls back to the live builtin table after evaluation.
+  registeredServers: [],
   disabledServerIds: /* @__PURE__ */ new Set(),
   serverOverrides: /* @__PURE__ */ new Map()
 };
 var configInFlight = /* @__PURE__ */ new Map();
 function normalizeWorkspacePath(cwd) {
-  return path4.resolve(cwd);
+  return path3.resolve(cwd);
+}
+var unknownTrustNoticeGeneration = -1;
+function sourceFor(provenance, key) {
+  const direct = provenanceFor({ value: void 0, provenance }, key);
+  if (direct)
+    return direct;
+  let fallback;
+  for (const [candidate, entry] of provenance) {
+    if (!candidate.startsWith(`${key}/`))
+      continue;
+    if (isRepoTier(entry.tier))
+      return entry;
+    fallback ??= entry;
+  }
+  return fallback;
+}
+function executableAllowed(provenance, trust) {
+  return !provenance || !isRepoTier(provenance.tier) || trust === "trusted";
+}
+function registryDecision(id, field, provenance, trust, allowed) {
+  if (allowed || !provenance || !isRepoTier(provenance.tier))
+    return;
+  const subject = `${id}:${field}:${provenance.tier}`;
+  const reason = `project LSP ${field} refused for ${id}: pi project trust is ${trust}`;
+  recordDegradationOnce({
+    kind: "lsp-registry-decision",
+    subject,
+    reason,
+    metadata: { serverId: id, field, tier: provenance.tier, trust }
+  });
+  if (trust === "unknown") {
+    const generation = getDegradationLedgerGeneration();
+    if (unknownTrustNoticeGeneration !== generation) {
+      unknownTrustNoticeGeneration = generation;
+      logExtension({
+        subsystem: "lsp-registry",
+        level: "warn",
+        message: "project LSP executables refused: mark the project trusted in pi or upgrade pi",
+        metadata: { serverId: id, field }
+      });
+    }
+  }
 }
 function isSameOrChildPath(filePath, candidateRoot) {
   if (filePath === candidateRoot)
     return true;
-  return filePath.startsWith(`${candidateRoot}${path4.sep}`);
+  return filePath.startsWith(`${candidateRoot}${path3.sep}`);
 }
 function getConfigForFile(filePath) {
-  const resolvedFilePath = path4.resolve(filePath);
+  const resolvedFilePath = path3.resolve(filePath);
   let bestMatch;
   for (const [root, config] of sessionRootConfigEntries()) {
     if (config === void 0)
@@ -1242,13 +1351,33 @@ function getConfigForFile(filePath) {
   return bestMatch?.config ?? EMPTY_CONFIG;
 }
 function registerLSPConfig(config) {
+  return compileLspRegistry(config, config.__provenance);
+}
+function compileLspRegistry(config, provenance = /* @__PURE__ */ new Map()) {
+  const trust = getProjectTrustState();
   const customServers = [];
   const disabledServerIds = new Set(config.disabledServers ?? []);
   if (config.servers) {
     for (const [id, serverConfig] of Object.entries(config.servers)) {
+      const commandSource = sourceFor(provenance, `/lsp/servers/${id}/command`);
+      const commandAllowed = executableAllowed(commandSource, trust);
+      registryDecision(id, "command", commandSource, trust, commandAllowed);
+      if (!commandAllowed)
+        continue;
+      const envSource = sourceFor(provenance, `/lsp/servers/${id}/env`);
+      const initSource = sourceFor(provenance, `/lsp/servers/${id}/initializationOptions`);
+      const envAllowed = executableAllowed(envSource, trust);
+      const initAllowed = executableAllowed(initSource, trust);
+      registryDecision(id, "env", envSource, trust, envAllowed);
+      registryDecision(id, "initializationOptions", initSource, trust, initAllowed);
+      const admitted = { ...serverConfig };
+      if (!envAllowed)
+        delete admitted.env;
+      if (!initAllowed)
+        delete admitted.initializationOptions;
       try {
-        const server = createCustomServer(serverConfig, id);
-        customServers.push(server);
+        const server = createCustomServer(admitted, id);
+        customServers.push({ ...server, trustAllowed: true });
       } catch {
       }
     }
@@ -1258,15 +1387,53 @@ function registerLSPConfig(config) {
     for (const [id, entry] of Object.entries(config.serverOverrides)) {
       if (entry && typeof entry === "object" && !Array.isArray(entry)) {
         const initOpts = entry.initializationOptions;
-        if (initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
+        const command = entry.command;
+        const commandSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/command`);
+        const envSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/env`);
+        const initSource = sourceFor(provenance, `/lsp/serverOverrides/${id}/initializationOptions`);
+        const commandAllowed = executableAllowed(commandSource, trust);
+        const envAllowed = executableAllowed(envSource, trust);
+        const overrideInitAllowed = executableAllowed(initSource, trust);
+        registryDecision(id, "command override", commandSource, trust, commandAllowed);
+        registryDecision(id, "env override", envSource, trust, envAllowed);
+        registryDecision(id, "initializationOptions", initSource, trust, overrideInitAllowed);
+        if (command !== void 0 || entry.env !== void 0 || initOpts !== void 0 && typeof initOpts === "object" && initOpts !== null && !Array.isArray(initOpts)) {
           serverOverrides.set(id, {
-            initializationOptions: initOpts
+            ...overrideInitAllowed && initOpts !== void 0 ? { initializationOptions: initOpts } : {},
+            ...commandAllowed && command !== void 0 ? { command } : {},
+            ...envAllowed && entry.env ? { env: entry.env } : {}
           });
         }
       }
     }
   }
-  return { customServers, disabledServerIds, serverOverrides };
+  const overriddenBuiltins = LSP_SERVERS.map((server) => {
+    const override = serverOverrides.get(server.id);
+    if (!override?.command)
+      return { ...server };
+    const argv = Array.isArray(override.command) ? override.command : [override.command, "--stdio"];
+    return {
+      ...server,
+      trustAllowed: true,
+      async spawn(root, options) {
+        void options;
+        const program = argv[0];
+        if (!program)
+          throw new Error(`empty command override for ${server.id}`);
+        const proc = await launchLSP(program, argv.slice(1), {
+          cwd: root,
+          env: override.env ? { ...process.env, ...override.env } : process.env
+        });
+        return { process: proc };
+      }
+    };
+  });
+  return {
+    customServers,
+    registeredServers: overriddenBuiltins,
+    disabledServerIds,
+    serverOverrides
+  };
 }
 function forgetConfigResolvedClaims(evictedRoots) {
   for (const root of evictedRoots) {
@@ -1293,7 +1460,8 @@ async function initLSPConfig(cwd) {
   }
 }
 function registeredServers(config) {
-  return [...LSP_SERVERS, ...config.customServers];
+  const builtins = config.registeredServers.length ? config.registeredServers : LSP_SERVERS;
+  return [...builtins, ...config.customServers];
 }
 function selectionReason(server, config, filePath, ext, base) {
   if (config.disabledServerIds.has(server.id))
@@ -1313,8 +1481,8 @@ function selectionReason(server, config, filePath, ext, base) {
   return "selected";
 }
 function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).map((server) => {
     const reason = selectionReason(server, config, filePath, ext, base);
     return { server, selected: reason === "selected", reason };
@@ -1322,8 +1490,8 @@ function explainServersForFile(filePath, config = getConfigForFile(filePath)) {
 }
 function getServersForFileWithConfig(filePath) {
   const config = getConfigForFile(filePath);
-  const ext = path4.extname(filePath).toLowerCase();
-  const base = path4.basename(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
+  const base = path3.basename(filePath).toLowerCase();
   return registeredServers(config).filter((server) => selectionReason(server, config, filePath, ext, base) === "selected");
 }
 function primaryServerEntry(filePath) {
@@ -1384,11 +1552,15 @@ function resolveAstGrepNativeExe(platform = process.platform, arch = process.arc
 }
 var SERVER_DIAGNOSTIC_STRATEGIES = {
   typescript: {
-    seedFirstPush: true,
+    seedFirstPush: false,
     pullRetryBudgetMs: 0,
     debounceMs: 50,
     aggregateWaitMs: 1e3,
     expectSemanticSecondPush: false,
+    // #3310 / nightly run 37930006227: the clean TypeScript fixture
+    // published an empty pre-index result before its settled result.
+    // Hold that first publish so it cannot resolve a push wait as clean.
+    emptyFirstPublish: "indexing",
     // Tier 3 (#458): typescript-language-server publishes nothing on a
     // clean→clean edit (docs/lsp-capability-matrix.md, re-confirmed
     // 2026-07-12). It's the lone core-set tier-3 server, which is exactly
@@ -1790,14 +1962,14 @@ function classifyCascadeWaitTier(lspService, filePath, snapshots) {
 // dist/clients/lsp/lombok.js
 import * as fs4 from "node:fs";
 import * as os4 from "node:os";
-import * as path5 from "node:path";
+import * as path4 from "node:path";
 var LOMBOK_ENV_KEYS = ["PI_LENS_LOMBOK_JAR", "LOMBOK_JAR"];
 var LOMBOK_PROJECT_FILES = [
   "lombok.config",
   "pom.xml",
   "build.gradle",
   "build.gradle.kts",
-  path5.join("gradle", "libs.versions.toml")
+  path4.join("gradle", "libs.versions.toml")
 ];
 function fileExists(filePath) {
   if (!filePath)
@@ -1822,13 +1994,13 @@ function containsLombokDependency(text) {
   return /\borg\.projectlombok\b/i.test(text) || /<artifactId>\s*lombok\s*<\/artifactId>/i.test(text) || /\b(annotationProcessor|compileOnly|testCompileOnly|testAnnotationProcessor)\b[^\n]*\blombok\b/i.test(text);
 }
 function hasLombokProject(root) {
-  const lombokConfig = path5.join(root, "lombok.config");
+  const lombokConfig = path4.join(root, "lombok.config");
   if (fileExists(lombokConfig))
     return true;
   for (const name of LOMBOK_PROJECT_FILES) {
     if (name === "lombok.config")
       continue;
-    const text = readTextIfSmall(path5.join(root, name));
+    const text = readTextIfSmall(path4.join(root, name));
     if (text && containsLombokDependency(text))
       return true;
   }
@@ -1838,16 +2010,16 @@ function envJarCandidate(env) {
   for (const key of LOMBOK_ENV_KEYS) {
     const value = env[key]?.trim();
     if (fileExists(value))
-      return path5.resolve(value);
+      return path4.resolve(value);
   }
   return void 0;
 }
 function localJarCandidates(root) {
   return [
-    path5.join(root, "lombok.jar"),
-    path5.join(root, ".lombok", "lombok.jar"),
-    path5.join(root, "lib", "lombok.jar"),
-    path5.join(root, "libs", "lombok.jar")
+    path4.join(root, "lombok.jar"),
+    path4.join(root, ".lombok", "lombok.jar"),
+    path4.join(root, "lib", "lombok.jar"),
+    path4.join(root, "libs", "lombok.jar")
   ];
 }
 function newestExistingJar(candidates) {
@@ -1866,17 +2038,17 @@ function newestExistingJar(candidates) {
   return best?.filePath;
 }
 function mavenLocalLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
+  const base = path4.join(home, ".m2", "repository", "org", "projectlombok", "lombok");
   let versions = [];
   try {
     versions = fs4.readdirSync(base);
   } catch {
     return void 0;
   }
-  return newestExistingJar(versions.map((version) => path5.join(base, version, `lombok-${version}.jar`)));
+  return newestExistingJar(versions.map((version) => path4.join(base, version, `lombok-${version}.jar`)));
 }
 function gradleCacheLombokJar(home = os4.homedir()) {
-  const base = path5.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
+  const base = path4.join(home, ".gradle", "caches", "modules-2", "files-2.1", "org.projectlombok", "lombok");
   const candidates = [];
   let versions = [];
   try {
@@ -1885,7 +2057,7 @@ function gradleCacheLombokJar(home = os4.homedir()) {
     return void 0;
   }
   for (const version of versions) {
-    const versionDir = path5.join(base, version);
+    const versionDir = path4.join(base, version);
     let hashes = [];
     try {
       hashes = fs4.readdirSync(versionDir);
@@ -1893,7 +2065,7 @@ function gradleCacheLombokJar(home = os4.homedir()) {
       continue;
     }
     for (const hash of hashes) {
-      candidates.push(path5.join(versionDir, hash, `lombok-${version}.jar`));
+      candidates.push(path4.join(versionDir, hash, `lombok-${version}.jar`));
     }
   }
   return newestExistingJar(candidates);
@@ -1926,15 +2098,15 @@ function createLombokJdtlsArgs(root, baseEnv = process.env) {
 // dist/clients/lsp/jvm-runtime.js
 import { existsSync as existsSync2, readdirSync as readdirSync4 } from "node:fs";
 import os5 from "node:os";
-import path6 from "node:path";
+import path5 from "node:path";
 var JAVA_EXE = process.platform === "win32" ? "java.exe" : "java";
 var JAVA_PROBE_TIMEOUT_MS = 5e3;
 var MIN_JAVA_MAJOR = 17;
 function jdkHomeFrom(dir) {
-  if (existsSync2(path6.join(dir, "bin", JAVA_EXE)))
+  if (existsSync2(path5.join(dir, "bin", JAVA_EXE)))
     return dir;
-  const macHome = path6.join(dir, "Contents", "Home");
-  if (existsSync2(path6.join(macHome, "bin", JAVA_EXE)))
+  const macHome = path5.join(dir, "Contents", "Home");
+  if (existsSync2(path5.join(macHome, "bin", JAVA_EXE)))
     return macHome;
   return void 0;
 }
@@ -1947,7 +2119,7 @@ function parseMajorVersion(name) {
 }
 function childDirs(base) {
   try {
-    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path6.join(base, e.name));
+    return readdirSync4(base, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => path5.join(base, e.name));
   } catch {
     return [];
   }
@@ -1955,26 +2127,26 @@ function childDirs(base) {
 function candidateRoots() {
   const home = os5.homedir();
   const roots = [];
-  roots.push(path6.join(home, ".jdks"));
-  roots.push(path6.join(getGlobalPiLensDir(), "tools"));
+  roots.push(path5.join(home, ".jdks"));
+  roots.push(path5.join(getGlobalPiLensDir(), "tools"));
   if (process.platform === "win32") {
     const progFiles = [
       process.env.ProgramFiles,
       process.env["ProgramFiles(x86)"],
       process.env.ProgramW6432,
-      path6.join(process.env.LOCALAPPDATA ?? path6.join(home, "AppData", "Local"), "Programs")
+      path5.join(process.env.LOCALAPPDATA ?? path5.join(home, "AppData", "Local"), "Programs")
     ].filter((p) => Boolean(p));
     for (const base of progFiles) {
-      roots.push(path6.join(base, "Eclipse Adoptium"));
-      roots.push(path6.join(base, "Java"));
-      roots.push(path6.join(base, "Microsoft"));
-      roots.push(path6.join(base, "Zulu"));
-      roots.push(path6.join(base, "Amazon Corretto"));
-      roots.push(path6.join(base, "BellSoft"));
+      roots.push(path5.join(base, "Eclipse Adoptium"));
+      roots.push(path5.join(base, "Java"));
+      roots.push(path5.join(base, "Microsoft"));
+      roots.push(path5.join(base, "Zulu"));
+      roots.push(path5.join(base, "Amazon Corretto"));
+      roots.push(path5.join(base, "BellSoft"));
     }
   } else if (process.platform === "darwin") {
     roots.push("/Library/Java/JavaVirtualMachines");
-    roots.push(path6.join(home, "Library", "Java", "JavaVirtualMachines"));
+    roots.push(path5.join(home, "Library", "Java", "JavaVirtualMachines"));
     roots.push("/opt/homebrew/opt");
     roots.push("/usr/local/opt");
   } else {
@@ -1998,7 +2170,7 @@ function discoverJdkHome(roots = candidateRoots(), javaHome = process.env.JAVA_H
         continue;
       found.push({
         home: resolved,
-        major: parseMajorVersion(path6.basename(dir))
+        major: parseMajorVersion(path5.basename(dir))
       });
     }
   }
@@ -2097,12 +2269,12 @@ async function resolveJavaRuntimeEnv() {
   }
   const home = discoverJdkHome();
   if (home) {
-    const binDir = path6.join(home, "bin");
+    const binDir = path5.join(home, "bin");
     const currentPath = process.env.PATH ?? process.env.Path ?? "";
     _cachedEnv = {
       value: {
         JAVA_HOME: home,
-        PATH: binDir + path6.delimiter + currentPath
+        PATH: binDir + path5.delimiter + currentPath
       }
     };
     return _cachedEnv.value;
@@ -2158,7 +2330,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     rootFailed = true;
     onRootFailure?.(reason);
   }
-  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path7.resolve(serverRoot) === path7.resolve(path7.dirname(filePath));
+  const isFileDirFallback = serverRoot !== void 0 && rootMarkers?.length && path6.resolve(serverRoot) === path6.resolve(path6.dirname(filePath));
   if (!serverRoot || isFileDirFallback) {
     const probedMarker = onRootFallback && !rootFailed && rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
       cwd: sessionCwd,
@@ -2167,7 +2339,7 @@ async function resolveLspServerCwd(server, filePath, sessionCwd, onRootFailure,
     }).marker : void 0;
     const refusedMarker = probedMarker !== void 0 && rootMarkers?.includes(probedMarker) ? probedMarker : void 0;
     const fallbackCwd = rootMarkers?.length ? resolveToolCwd("lsp", server.id, filePath, {
-      cwd: path7.dirname(path7.resolve(filePath)),
+      cwd: path6.dirname(path6.resolve(filePath)),
       rootMarkers
     }) : void 0;
     if (!serverRoot) {
@@ -2237,17 +2409,17 @@ var PROJECT_BOUNDARY_MARKERS = [
 var loggedRootCeilingClamps = /* @__PURE__ */ new Set();
 var posixCaseInsensitiveByPath = /* @__PURE__ */ new Map();
 function posixFilesystemIsCaseInsensitive(root) {
-  const resolved = path7.resolve(root);
+  const resolved = path6.resolve(root);
   const cached = posixCaseInsensitiveByPath.get(resolved);
   if (cached !== void 0)
     return cached;
   if (!existsSync3(resolved)) {
     return false;
   }
-  const name = path7.basename(resolved);
+  const name = path6.basename(resolved);
   const alternate = name.toLowerCase() === name ? name.toUpperCase() : name.toLowerCase();
   let insensitive = false;
-  const alternatePath = path7.join(path7.dirname(resolved), alternate);
+  const alternatePath = path6.join(path6.dirname(resolved), alternate);
   if (alternate !== name && existsSync3(alternatePath)) {
     try {
       const actual = statSync3(resolved);
@@ -2265,7 +2437,7 @@ function resetLSPCaseSensitivityState() {
 }
 function isSameOrWithin(ancestor, candidate, deps = {}) {
   const windowsShaped = isWindowsPath(ancestor) || isWindowsPath(candidate);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedAncestor = pathApi.resolve(ancestor);
   const resolvedCandidate = pathApi.resolve(candidate);
   let caseInsensitive = false;
@@ -2285,7 +2457,7 @@ function isSameOrWithin(ancestor, candidate, deps = {}) {
 }
 function enforceLspRootCeiling(root, sessionCwd, filePath) {
   const windowsShaped = isWindowsPath(root) || isWindowsPath(sessionCwd);
-  const pathApi = windowsShaped ? path7.win32 : path7;
+  const pathApi = windowsShaped ? path6.win32 : path6;
   const resolvedRoot = pathApi.resolve(root);
   const resolvedCwd = pathApi.resolve(sessionCwd);
   if (filePath && !isSameOrWithin(resolvedCwd, pathApi.resolve(filePath))) {
@@ -2310,8 +2482,8 @@ async function hasProjectBoundaryMarker(dir) {
   return false;
 }
 function pathSegments(dir) {
-  const parsed = path7.parse(path7.resolve(dir));
-  return path7.relative(parsed.root, path7.resolve(dir)).split(path7.sep).filter(Boolean).map((segment) => segment.toLowerCase());
+  const parsed = path6.parse(path6.resolve(dir));
+  return path6.relative(parsed.root, path6.resolve(dir)).split(path6.sep).filter(Boolean).map((segment) => segment.toLowerCase());
 }
 function hasFixtureConvention(dir) {
   const segments = pathSegments(dir);
@@ -2323,18 +2495,18 @@ function hasAtomicStageSegment(dir) {
   return pathSegments(dir).some((segment) => STAGE_TMP_PATTERN.test(segment));
 }
 async function findGitBoundary(dir) {
-  let current = path7.resolve(dir);
-  const fsRoot = path7.parse(current).root;
+  let current = path6.resolve(dir);
+  const fsRoot = path6.parse(current).root;
   while (true) {
     if (await markerExists(current, ".git"))
       return current;
     if (current === fsRoot)
       return void 0;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
 }
 async function isExcludedLspRoot(dir) {
-  const candidate = path7.resolve(dir);
+  const candidate = path6.resolve(dir);
   if (hasFixtureConvention(candidate) || hasAtomicStageSegment(candidate))
     return true;
   const gitRoot = await findGitBoundary(candidate);
@@ -2346,9 +2518,9 @@ async function isExcludedLspRoot(dir) {
 }
 async function nearestNonExcludedFallbackRoot(candidate) {
   if (!await isExcludedLspRoot(candidate))
-    return path7.resolve(candidate);
-  let current = path7.dirname(path7.resolve(candidate));
-  const fsRoot = path7.parse(current).root;
+    return path6.resolve(candidate);
+  let current = path6.dirname(path6.resolve(candidate));
+  const fsRoot = path6.parse(current).root;
   let nearestAllowed;
   while (true) {
     if (!await isExcludedLspRoot(current)) {
@@ -2360,7 +2532,7 @@ async function nearestNonExcludedFallbackRoot(candidate) {
     }
     if (current === fsRoot)
       break;
-    current = path7.dirname(current);
+    current = path6.dirname(current);
   }
   return nearestAllowed ?? fsRoot;
 }
@@ -2401,7 +2573,7 @@ async function installEvidenceForLaunch(toolId, installed, attempt) {
   const confirmedManagedPath = await findManagedToolBinary(toolId);
   return {
     ...evidence,
-    binary: path7.basename(installed),
+    binary: path6.basename(installed),
     ...confirmedManagedPath !== void 0 && pathsEqual(confirmedManagedPath, installed) && {
       source: "managed-dir"
     }
@@ -2454,7 +2626,7 @@ function markDirectLspCommandUnavailable(command) {
   directLspCommandUnavailableUntil.set(command, Date.now() + DIRECT_LSP_NEGATIVE_TTL_MS);
   directLspCommandSkipLoggedUntil.delete(command);
 }
-var PI_LENS_BIN_DIR2 = path7.join(getGlobalPiLensDir(), "bin");
+var PI_LENS_BIN_DIR2 = path6.join(getGlobalPiLensDir(), "bin");
 async function resolveAndLaunch(spec, allowInstall) {
   const generation = lspLaunchAvailabilityGeneration.capture();
   const toolLabel = spec.managedToolId ?? spec.candidates[spec.candidates.length - 1] ?? "unknown";
@@ -2519,7 +2691,7 @@ async function resolveAndLaunch(spec, allowInstall) {
           producer: "lsp-launch",
           classifiedBy: "probe",
           evidence: {
-            binary: path7.basename(managedCandidate),
+            binary: path6.basename(managedCandidate),
             source: "managed-dir",
             correctsLatchedRow: false
           }
@@ -2812,7 +2984,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
     return void 0;
   }
   const suffix = process.platform === "win32" ? ".exe" : "";
-  const binPath = path7.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
+  const binPath = path6.join(bundleDir, ...spec.binRelPath.split("/")) + suffix;
   try {
     const proc = await launchLSP(binPath, spec.args, {
       cwd: spec.cwd,
@@ -2827,7 +2999,7 @@ async function resolveAndLaunchTreeBinary(spec, allowInstall) {
   }
 }
 function nodeBinLocalCandidates(root, baseName) {
-  const localBase = path7.join(root, "node_modules", ".bin", baseName);
+  const localBase = path6.join(root, "node_modules", ".bin", baseName);
   if (process.platform === "win32") {
     return [`${localBase}.cmd`, `${localBase}.exe`];
   }
@@ -2837,7 +3009,7 @@ function nodeBinCandidates(root, baseName) {
   return [...nodeBinLocalCandidates(root, baseName), baseName];
 }
 function piAgentExtensionsRootKey(file) {
-  const dirKey = normalizeEphemeralMapKey(path7.dirname(path7.resolve(file)));
+  const dirKey = normalizeEphemeralMapKey(path6.dirname(path6.resolve(file)));
   const marker = "/.pi/agent/extensions";
   const index = dirKey.indexOf(marker);
   if (index === -1)
@@ -2845,12 +3017,12 @@ function piAgentExtensionsRootKey(file) {
   return dirKey.slice(0, index + marker.length);
 }
 function IgnoreHomeRoot(primary) {
-  const homeKey = normalizeEphemeralMapKey(path7.resolve(os6.homedir()));
+  const homeKey = normalizeEphemeralMapKey(path6.resolve(os6.homedir()));
   return withRootMarkers(async (file) => {
     const root = await primary(file);
     if (!root)
       return void 0;
-    return normalizeEphemeralMapKey(path7.resolve(root)) === homeKey ? void 0 : root;
+    return normalizeEphemeralMapKey(path6.resolve(root)) === homeKey ? void 0 : root;
   }, primary.rootMarkers ?? []);
 }
 function rubyBinCandidates(baseName) {
@@ -2858,13 +3030,13 @@ function rubyBinCandidates(baseName) {
   const home = os6.homedir();
   const isWin = process.platform === "win32";
   const ext = isWin ? ".bat" : "";
-  candidates.push(path7.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
-  candidates.push(path7.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".local", "share", "mise", "installs", "ruby", "bin", `${baseName}${ext}`));
+  candidates.push(path6.join(home, ".asdf", "installs", "ruby", "bin", `${baseName}${ext}`));
   if (isWin) {
-    const driveRoot = path7.parse(home).root;
+    const driveRoot = path6.parse(home).root;
     for (const entry of getRubyVersionDirNamesSync(driveRoot)) {
-      candidates.push(path7.join(driveRoot, entry, "bin", `${baseName}.bat`));
-      candidates.push(path7.join(driveRoot, entry, "bin", baseName));
+      candidates.push(path6.join(driveRoot, entry, "bin", `${baseName}.bat`));
+      candidates.push(path6.join(driveRoot, entry, "bin", baseName));
     }
   }
   return candidates;
@@ -2884,6 +3056,7 @@ function createInteractiveServer(spec) {
     rootMarkers: spec.root.rootMarkers,
     fallbackFor: spec.fallbackFor,
     requiresProjectRoot: spec.requiresProjectRoot,
+    executesProjectCode: spec.executesProjectCode,
     availabilityKey: typeof spec.command === "string" && isSimpleCommand(spec.command) ? spec.command : void 0,
     async spawn(root) {
       const command = typeof spec.command === "function" ? spec.command(root) : spec.command;
@@ -2920,7 +3093,7 @@ function PriorityRoot(markerGroups, excludePatterns, stopDir) {
   }, markerGroups.flat());
 }
 var FileDirRoot = async (file) => {
-  const candidate = path7.resolve(path7.dirname(file));
+  const candidate = path6.resolve(path6.dirname(file));
   return nearestNonExcludedFallbackRoot(candidate);
 };
 function RootWithFallback(primary, fallback = FileDirRoot) {
@@ -2942,16 +3115,16 @@ function markerProbeDir(dir, pattern) {
   const normalized = toPosix(pattern);
   const slash = normalized.lastIndexOf("/");
   const parentPattern = slash >= 0 ? normalized.slice(0, slash) : "";
-  return parentPattern ? path7.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
+  return parentPattern ? path6.join(dir, ...parentPattern.split("/").filter(Boolean)) : dir;
 }
 async function markerExists(dir, pattern) {
   if (!pattern.includes("*")) {
     try {
-      await stat(path7.join(dir, pattern));
+      await stat(path6.join(dir, pattern));
       return true;
     } catch (err) {
       if (isPermissionFsError(err)) {
-        logSessionStart(`lsp root marker skipped: permission error stat ${path7.join(dir, pattern)}`);
+        logSessionStart(`lsp root marker skipped: permission error stat ${path6.join(dir, pattern)}`);
       }
       return false;
     }
@@ -2987,7 +3160,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
       subdirPatterns.push(pattern);
   }
   return withRootMarkers(async (file) => {
-    const startDir = path7.resolve(path7.dirname(file));
+    const startDir = path6.resolve(path6.dirname(file));
     const dirKey = normalizeMapKey(startDir);
     const cached = cache.get(dirKey);
     if (cached !== void 0 && Date.now() - cached.walkedAt < FRESHNESS_CADENCE_MS && await bounded(dirMtimesStillFreshAsync(cached.probedDirs), rootMtimeBound("lsp-root-memo-freshness")) === true)
@@ -2999,10 +3172,10 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
     const walkedAt = Date.now();
     const promise = (async () => {
       let currentDir = startDir;
-      const fsRoot = path7.parse(currentDir).root;
-      const stop = stopDir ? path7.resolve(stopDir) : fsRoot;
+      const fsRoot = path6.parse(currentDir).root;
+      const stop = stopDir ? path6.resolve(stopDir) : fsRoot;
       while (true) {
-        if (stop !== fsRoot && currentDir.startsWith(stop + path7.sep) === false && currentDir !== stop) {
+        if (stop !== fsRoot && currentDir.startsWith(stop + path6.sep) === false && currentDir !== stop) {
           break;
         }
         const stepDirs = [
@@ -3020,7 +3193,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
             }
           }
           if (excluded) {
-            currentDir = path7.dirname(currentDir);
+            currentDir = path6.dirname(currentDir);
             continue;
           }
         }
@@ -3032,7 +3205,7 @@ function NearestRoot(includePatterns, excludePatterns, stopDir) {
         if (currentDir === stop || currentDir === fsRoot) {
           break;
         }
-        currentDir = path7.dirname(currentDir);
+        currentDir = path6.dirname(currentDir);
       }
       return void 0;
     })();
@@ -3074,17 +3247,17 @@ async function findAncestorFile(startDir, ...relativeSegments) {
 }
 async function findAncestorFileAmong(startDir, candidateSegmentLists) {
   const fs5 = await import("node:fs/promises");
-  let currentDir = path7.resolve(startDir);
+  let currentDir = path6.resolve(startDir);
   while (!isAtOrAboveHomeDir(currentDir)) {
     for (const segments of candidateSegmentLists) {
-      const candidate = path7.join(currentDir, ...segments);
+      const candidate = path6.join(currentDir, ...segments);
       try {
         await fs5.access(candidate);
         return candidate;
       } catch {
       }
     }
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       break;
     currentDir = parent;
@@ -3100,19 +3273,19 @@ function resetClassicTsRepairGuard() {
   classicTsRepairState().attempted = false;
 }
 function typescriptDirsForTsc(tscPath) {
-  const binDir = path7.dirname(tscPath);
+  const binDir = path6.dirname(tscPath);
   return [
-    path7.join(binDir, "..", "typescript"),
-    path7.join(binDir, "..", "..", "typescript")
+    path6.join(binDir, "..", "typescript"),
+    path6.join(binDir, "..", "..", "typescript")
   ];
 }
 async function typescriptVersionForTsc(tscPath) {
-  if (!path7.isAbsolute(tscPath))
+  if (!path6.isAbsolute(tscPath))
     return void 0;
   for (const dir of typescriptDirsForTsc(tscPath)) {
     let manifest;
     try {
-      manifest = await readFile(path7.join(dir, "package.json"), "utf8");
+      manifest = await readFile(path6.join(dir, "package.json"), "utf8");
     } catch {
       continue;
     }
@@ -3134,25 +3307,45 @@ async function typescriptVersionForTsc(tscPath) {
   }
   return void 0;
 }
-async function findTsserverPath(root, allowInstall) {
+async function findTsserverPath(root, allowInstall, options) {
   const fs5 = await import("node:fs/promises");
+  const projectRoots = await Promise.all([root, options?.sessionRoot ?? process.cwd(), process.cwd()].map((dir) => fs5.realpath(dir).catch(() => path6.resolve(dir))));
+  const admitCandidate = async (candidate, projectSupplied) => {
+    try {
+      const real = await fs5.realpath(candidate);
+      if (path6.basename(real) !== "tsserver.js" || !(await fs5.stat(real)).isFile())
+        return void 0;
+      const manifest = JSON.parse(await fs5.readFile(path6.join(path6.dirname(real), "..", "package.json"), "utf8"));
+      if (typeof manifest?.version !== "string" || !manifest.version)
+        return void 0;
+      return admitProjectSuppliedTsserver(real, options?.sessionRoot ?? process.cwd(), projectSupplied || projectRoots.some((dir) => isUnderDir(real, dir)), options?.projectCodeAllowed);
+    } catch {
+      return void 0;
+    }
+  };
   const ancestorHit = await findAncestorFile(root, "node_modules", "typescript", "lib", "tsserver.js");
-  if (ancestorHit)
-    return ancestorHit;
-  const cwdCandidate = path7.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
+  if (ancestorHit) {
+    const admittedAncestor = await admitCandidate(ancestorHit, true);
+    if (admittedAncestor)
+      return admittedAncestor;
+  }
+  const cwdCandidate = path6.join(process.cwd(), "node_modules", "typescript", "lib", "tsserver.js");
   try {
     await fs5.access(cwdCandidate);
-    return cwdCandidate;
+    const admittedCwd = await admitCandidate(cwdCandidate, false);
+    if (admittedCwd)
+      return admittedCwd;
   } catch {
   }
   const tsserverForTsc = async (tscPath) => {
-    if (!tscPath)
+    if (!tscPath || !path6.isAbsolute(tscPath))
       return void 0;
     for (const dir of typescriptDirsForTsc(tscPath)) {
-      const candidate = path7.join(dir, "lib", "tsserver.js");
+      const candidate = path6.join(dir, "lib", "tsserver.js");
       try {
-        await fs5.access(candidate);
-        return candidate;
+        const admitted = await admitCandidate(candidate, false);
+        if (admitted)
+          return admitted;
       } catch {
       }
     }
@@ -3178,10 +3371,10 @@ async function findTsserverPath(root, allowInstall) {
   return tsserverForTsc(repairedTsc);
 }
 async function findNativeTypeScriptLsp(root) {
-  let currentDir = path7.resolve(root);
+  let currentDir = path6.resolve(root);
   while (!isAtOrAboveHomeDir(currentDir)) {
-    const typescriptDir = path7.join(currentDir, "node_modules", "typescript");
-    const packageJsonPath = path7.join(typescriptDir, "package.json");
+    const typescriptDir = path6.join(currentDir, "node_modules", "typescript");
+    const packageJsonPath = path6.join(typescriptDir, "package.json");
     let packageJsonText;
     try {
       packageJsonText = await readFile(packageJsonPath, "utf8");
@@ -3195,7 +3388,7 @@ async function findNativeTypeScriptLsp(root) {
           return void 0;
       } catch {
       }
-      const parent = path7.dirname(currentDir);
+      const parent = path6.dirname(currentDir);
       if (parent === currentDir)
         return void 0;
       currentDir = parent;
@@ -3215,7 +3408,7 @@ async function findNativeTypeScriptLsp(root) {
     const major = /^\d+$/.test(majorText) ? Number(majorText) : Number.NaN;
     if (!Number.isFinite(major) || major < 7)
       return void 0;
-    const localTsc = path7.join(currentDir, "node_modules", ".bin", "tsc");
+    const localTsc = path6.join(currentDir, "node_modules", ".bin", "tsc");
     const candidates = process.platform === "win32" ? [`${localTsc}.cmd`, `${localTsc}.exe`, localTsc] : [localTsc];
     for (const command of candidates) {
       try {
@@ -3231,23 +3424,23 @@ async function findNativeTypeScriptLsp(root) {
 function dotnetToolCandidates(tool) {
   const home = os6.homedir();
   return [
-    path7.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
-    path7.join(PI_LENS_BIN_DIR2, tool),
-    path7.join(home, ".dotnet", "tools", `${tool}.exe`),
-    path7.join(home, ".dotnet", "tools", tool),
+    path6.join(PI_LENS_BIN_DIR2, `${tool}.exe`),
+    path6.join(PI_LENS_BIN_DIR2, tool),
+    path6.join(home, ".dotnet", "tools", `${tool}.exe`),
+    path6.join(home, ".dotnet", "tools", tool),
     tool
   ].filter(Boolean);
 }
 function binExeVariants(dir, tool) {
-  return process.platform === "win32" ? [path7.join(dir, `${tool}.exe`), path7.join(dir, tool)] : [path7.join(dir, tool)];
+  return process.platform === "win32" ? [path6.join(dir, `${tool}.exe`), path6.join(dir, tool)] : [path6.join(dir, tool)];
 }
 function goBinCandidates(tool) {
-  const gopath = process.env.GOPATH?.split(path7.delimiter)[0] || path7.join(os6.homedir(), "go");
-  return [tool, ...binExeVariants(path7.join(gopath, "bin"), tool)];
+  const gopath = process.env.GOPATH?.split(path6.delimiter)[0] || path6.join(os6.homedir(), "go");
+  return [tool, ...binExeVariants(path6.join(gopath, "bin"), tool)];
 }
 function cargoBinCandidates(tool) {
-  const cargoHome = process.env.CARGO_HOME || path7.join(os6.homedir(), ".cargo");
-  return [tool, ...binExeVariants(path7.join(cargoHome, "bin"), tool)];
+  const cargoHome = process.env.CARGO_HOME || path6.join(os6.homedir(), ".cargo");
+  return [tool, ...binExeVariants(path6.join(cargoHome, "bin"), tool)];
 }
 async function tryGemInstall(gem) {
   const { join: join3 } = await import("node:path");
@@ -3285,7 +3478,7 @@ var TS_TOOLING_MARKERS = [
 ];
 var TS_FAMILY_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]);
 function isTsFamilyFile(file) {
-  return TS_FAMILY_EXTENSIONS.has(path7.extname(file).toLowerCase());
+  return TS_FAMILY_EXTENSIONS.has(path6.extname(file).toLowerCase());
 }
 function tsConfigMarkersForFile(file) {
   return isTsFamilyFile(file) ? ["tsconfig.json"] : TS_CONFIG_MARKERS;
@@ -3306,40 +3499,40 @@ async function findTypeScriptProjectRoot(file) {
   return isSameOrWithin(toolingRoot, configRoot) ? configRoot : toolingRoot;
 }
 async function findExtensionBoundedRoot(file, extensionRootKey) {
-  const startDir = path7.resolve(path7.dirname(file));
+  const startDir = path6.resolve(path6.dirname(file));
   let currentDir = startDir;
   const configMarkers = tsConfigMarkersForFile(file);
   while (true) {
     for (const pattern of configMarkers) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
     for (const pattern of TS_TOOLING_MARKERS) {
       try {
-        await stat(path7.join(currentDir, pattern));
+        await stat(path6.join(currentDir, pattern));
         return currentDir;
       } catch {
       }
     }
-    const currentKey = normalizeEphemeralMapKey(path7.resolve(currentDir));
+    const currentKey = normalizeEphemeralMapKey(path6.resolve(currentDir));
     if (currentKey === extensionRootKey)
       return void 0;
-    const parent = path7.dirname(currentDir);
+    const parent = path6.dirname(currentDir);
     if (parent === currentDir)
       return void 0;
     currentDir = parent;
   }
 }
 async function hasAgentLevelProjectMarker(extensionRootKey) {
-  const agentDir = path7.dirname(extensionRootKey);
+  const agentDir = path6.dirname(extensionRootKey);
   if (!agentDir || agentDir === extensionRootKey)
     return false;
   for (const pattern of [...TS_CONFIG_MARKERS, ...TS_TOOLING_MARKERS]) {
     try {
-      await stat(path7.join(agentDir, pattern));
+      await stat(path6.join(agentDir, pattern));
       return true;
     } catch {
     }
@@ -3367,14 +3560,14 @@ var TypeScriptServer = {
   idleEviction: "transparent",
   role: "language",
   name: "TypeScript Language Server",
+  projectLocalCommand: "typescript-language-server",
   extensions: JS_TS_LSP_EXTENSIONS,
   autoPropagateDiagnostics: true,
   root: TypeScriptRoot,
   rootMarkers: TypeScriptRoot.rootMarkers,
   async spawn(root, options) {
-    const fs5 = await import("node:fs/promises");
     const nativeLsp = await findNativeTypeScriptLsp(root);
-    if (nativeLsp) {
+    if (nativeLsp && admitProjectSuppliedTsserver(nativeLsp.command, root, true, options?.projectCodeAllowed)) {
       const env2 = await getToolEnvironment();
       logSessionStart(`lsp typescript-native: version=${nativeLsp.version} command=${nativeLsp.command}`);
       const proc2 = await launchLSP(nativeLsp.command, ["--lsp", "--stdio"], {
@@ -3398,14 +3591,10 @@ var TypeScriptServer = {
         return void 0;
       }
     }
-    let tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     if (!tsserverPath) {
-      const localCandidate = path7.join(path7.dirname(lspPath), "..", "typescript", "lib", "tsserver.js");
-      try {
-        await fs5.access(localCandidate);
-        tsserverPath = localCandidate;
-      } catch {
-      }
+      admitProjectSuppliedTsserver(void 0, root, true, options?.projectCodeAllowed);
+      return void 0;
     }
     if (tsserverPath)
       source = "managed";
@@ -3521,13 +3710,13 @@ var PythonServer = {
     if (!pyrightPath)
       return void 0;
     source = "managed";
-    const binDir = path7.dirname(pyrightPath);
+    const binDir = path6.dirname(pyrightPath);
     const isWindows2 = process.platform === "win32";
     const managedCandidates = isWindows2 ? [
-      path7.join(binDir, "pyright-langserver.cmd"),
-      path7.join(binDir, "pyright-langserver"),
+      path6.join(binDir, "pyright-langserver.cmd"),
+      path6.join(binDir, "pyright-langserver"),
       "pyright-langserver"
-    ] : [path7.join(binDir, "pyright-langserver"), "pyright-langserver"];
+    ] : [path6.join(binDir, "pyright-langserver"), "pyright-langserver"];
     const resolved = await resolveAndLaunch({ candidates: managedCandidates, args: ["--stdio"], cwd: root, env }, false);
     if (!resolved)
       return void 0;
@@ -3596,7 +3785,7 @@ var GoServer = {
   }
 };
 function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
-  const relativePath = path7.relative(parentDir, childDir).split(path7.sep).join("/");
+  const relativePath = path6.relative(parentDir, childDir).split(path6.sep).join("/");
   if (relativePath === "" || relativePath.startsWith(".."))
     return false;
   const matches = (pattern) => matchesWorkspaceMemberPattern(pattern, relativePath, CARGO_WORKSPACE_MEMBER_DIALECT, () => recordDegradationOnce({
@@ -3610,7 +3799,7 @@ function cargoWorkspaceDeclaresMember(workspaceContent, parentDir, childDir) {
   return readCargoWorkspaceMembers(workspaceContent).some(matches);
 }
 function sessionHoistCeiling(sessionCwd, file) {
-  return isSameOrWithin(path7.resolve(sessionCwd), path7.resolve(file)) ? path7.resolve(sessionCwd) : void 0;
+  return isSameOrWithin(path6.resolve(sessionCwd), path6.resolve(file)) ? path6.resolve(sessionCwd) : void 0;
 }
 function RustWorkspaceRoot() {
   const crateRoot = createRootDetector(["Cargo.toml", "Cargo.lock"]);
@@ -3621,14 +3810,14 @@ function RustWorkspaceRoot() {
     const sessionCwd = process.cwd();
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
-      const parentCargoPath = path7.join(parent, "Cargo.toml");
+      const parentCargoPath = path6.join(parent, "Cargo.toml");
       const parentCargoContent = await readTextFileOrUndefined(parentCargoPath);
       if (parentCargoContent !== void 0 && hasCargoWorkspaceTable(parentCargoContent)) {
         if (cargoWorkspaceDeclaresMember(parentCargoContent, parent, root)) {
@@ -3656,9 +3845,9 @@ async function declaresMavenModule(parentDir, parentPomPath, childDir) {
     const modulesBlock = content.match(/<modules>([\s\S]*?)<\/modules>/);
     if (!modulesBlock)
       return false;
-    const resolvedChild = path7.resolve(childDir);
+    const resolvedChild = path6.resolve(childDir);
     for (const match of modulesBlock[1].matchAll(/<module>\s*([^<]+?)\s*<\/module>/g)) {
-      if (pathsEqual(path7.resolve(parentDir, match[1]), resolvedChild))
+      if (pathsEqual(path6.resolve(parentDir, match[1]), resolvedChild))
         return true;
     }
     return false;
@@ -3682,15 +3871,15 @@ function JavaWorkspaceRoot() {
     const stop = sessionHoistCeiling(sessionCwd, file);
     let current = root;
     let lastHop = root;
-    const fsRoot = path7.parse(current).root;
+    const fsRoot = path6.parse(current).root;
     while (true) {
       if (stop !== void 0 && current === stop)
         break;
-      const parent = path7.dirname(current);
+      const parent = path6.dirname(current);
       if (parent === current || parent === fsRoot)
         break;
       if (await markerExists(parent, "pom.xml")) {
-        const parentPom = path7.join(parent, "pom.xml");
+        const parentPom = path6.join(parent, "pom.xml");
         if (!await declaresMavenModule(parent, parentPom, lastHop))
           break;
         current = parent;
@@ -3709,6 +3898,7 @@ var RustServer = {
   // Measured (#3750): rust-analyzer answers an empty result for a detached file.
   requiresProjectRoot: true,
   name: "rust-analyzer",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["rust"],
   // No FileDirRoot fallback (#201): rust-analyzer is a heavy workspace server
   // that is useless without a Cargo manifest. With the fallback, every .rs file
@@ -3742,6 +3932,7 @@ var RubyServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Ruby LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["ruby"],
   root: RootWithFallback(PriorityRoot([["Gemfile", ".ruby-version"], [".git"]])),
   // Ruby LSP may need extra time to finish composed-bundle setup before it can
@@ -3794,17 +3985,17 @@ var PHPServer = {
     return {
       ...result,
       initialization: {
-        storagePath: path7.join(getGlobalPiLensDir(), "intelephense")
+        storagePath: path6.join(getGlobalPiLensDir(), "intelephense")
       }
     };
   }
 };
 function buildPsesArgs(bundleDir) {
-  const script = path7.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
-  const sessionDir = path7.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
+  const script = path6.join(bundleDir, "PowerShellEditorServices", "Start-EditorServices.ps1");
+  const sessionDir = path6.join(getGlobalPiLensDir(), "pses", `${process.pid}-${Date.now()}`);
   mkdirSync2(sessionDir, { recursive: true });
-  const logPath = path7.join(sessionDir, "pses.log");
-  const sessionDetailsPath = path7.join(sessionDir, "session.json");
+  const logPath = path6.join(sessionDir, "pses.log");
+  const sessionDetailsPath = path6.join(sessionDir, "session.json");
   return [
     "-NoLogo",
     "-NoProfile",
@@ -3838,6 +4029,7 @@ var PowerShellServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "PowerShell Editor Services",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["powershell"],
   // Index at the workspace (script modules reference siblings); fall back to the
   // file dir.
@@ -3858,6 +4050,7 @@ var CSharpServer = {
   // Documented (#3750): csharp-ls needs a solution or project.
   requiresProjectRoot: true,
   name: "csharp-ls",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["csharp"],
   // No FileDirRoot fallback (#201): csharp-ls is a workspace server and should
   // not spawn once per source directory before a .sln/.csproj exists. Glob root
@@ -3881,6 +4074,7 @@ var CSharpServer = {
 var OmniSharpServer = createInteractiveServer({
   id: "omnisharp",
   name: "OmniSharp",
+  executesProjectCode: true,
   // Documented (#3750): OmniSharp needs a solution or project.
   requiresProjectRoot: true,
   fallbackFor: "csharp",
@@ -3897,6 +4091,7 @@ var FSharpServer = {
   // Documented (#3750): FSAutocomplete needs a project.
   requiresProjectRoot: true,
   name: "FSAutocomplete",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["fsharp"],
   root: createRootDetector([...DOTNET_FSHARP_ROOT_MARKERS]),
   async spawn(root, options) {
@@ -3916,6 +4111,7 @@ var FSharpServer = {
 var JavaServer = createInteractiveServer({
   id: "java",
   name: "JDT Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["java"],
   root: RootWithFallback(JavaWorkspaceRoot()),
   language: "java",
@@ -3928,6 +4124,7 @@ var KotlinServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Kotlin Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["kotlin"],
   root: RootWithFallback(createRootDetector(["build.gradle.kts", "build.gradle", "pom.xml"])),
   async spawn(root, options) {
@@ -3943,9 +4140,26 @@ var KotlinServer = {
     }, options?.allowInstall);
   }
 };
+var LeanServer = createInteractiveServer({
+  id: "lean",
+  name: "Lean 4 Language Server",
+  extensions: KIND_EXTENSIONS.lean,
+  root: RootWithFallback(createRootDetector([...LEAN_ROOT_MARKERS])),
+  language: "lean",
+  // Documented (#3750): `lake serve` analyses a file only when a Lake project
+  // roots it; a root-fallback empty answer is unconfirmed, not clean.
+  requiresProjectRoot: true,
+  // `lake serve` loads and interprets the project's `lakefile.lean` and its
+  // imported build scripts, so it executes project-owned code: refuse it until
+  // the host grants project trust (#4269).
+  executesProjectCode: true,
+  command: "lake",
+  args: ["serve"]
+});
 var SwiftServer = createInteractiveServer({
   id: "swift",
   name: "SourceKit-LSP",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["swift"],
   root: createRootDetector(["Package.swift"]),
   language: "swift",
@@ -3953,6 +4167,7 @@ var SwiftServer = createInteractiveServer({
 });
 var DartServer = createInteractiveServer({
   id: "dart",
+  executesProjectCode: true,
   name: "Dart Analysis Server",
   extensions: KIND_EXTENSIONS["dart"],
   root: RootWithFallback(createRootDetector(["pubspec.yaml"])),
@@ -4006,6 +4221,7 @@ var CppServer = createTreeBinaryServer({
 });
 var ZigServer = {
   id: "zig",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "ZLS",
@@ -4023,6 +4239,7 @@ var ZigServer = {
 var HaskellServer = createInteractiveServer({
   id: "haskell",
   name: "Haskell Language Server",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["haskell"],
   root: createRootDetector(["stack.yaml", "cabal.project", "*.cabal"]),
   language: "haskell",
@@ -4032,6 +4249,7 @@ var HaskellServer = createInteractiveServer({
 var ElixirServer = createInteractiveServer({
   id: "elixir",
   name: "ElixirLS",
+  executesProjectCode: true,
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
   language: "elixir",
@@ -4042,6 +4260,7 @@ var ElixirExpertServer = {
   idleEviction: "unmeasured",
   role: "language",
   name: "Expert",
+  executesProjectCode: true,
   fallbackFor: "elixir",
   extensions: KIND_EXTENSIONS["elixir"],
   root: RootWithFallback(createRootDetector(["mix.exs"])),
@@ -4074,6 +4293,7 @@ var GleamServer = {
 };
 var TinymistServer = {
   id: "tinymist",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Tinymist",
@@ -4110,6 +4330,7 @@ var MarksmanServer = {
 };
 var OCamlServer = createInteractiveServer({
   id: "ocaml",
+  executesProjectCode: true,
   name: "ocamllsp",
   extensions: KIND_EXTENSIONS["ocaml"],
   root: createRootDetector(["dune-project", "opam"]),
@@ -4118,6 +4339,7 @@ var OCamlServer = createInteractiveServer({
 });
 var ClojureServer = {
   id: "clojure",
+  executesProjectCode: true,
   idleEviction: "transparent",
   role: "language",
   name: "Clojure LSP",
@@ -4150,6 +4372,7 @@ var CueServer = {
 };
 var TerraformServer = {
   id: "terraform",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Terraform LSP",
@@ -4166,6 +4389,7 @@ var TerraformServer = {
 };
 var NixServer = createInteractiveServer({
   id: "nix",
+  executesProjectCode: true,
   name: "nixd",
   extensions: KIND_EXTENSIONS["nix"],
   root: createRootDetector(["flake.nix"]),
@@ -4234,6 +4458,7 @@ var FishServer = {
 };
 var CMakeServer = {
   id: "cmake",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "CMake Language Server",
@@ -4404,6 +4629,7 @@ var PrismaServer = {
 };
 var VueServer = {
   id: "vue",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Vue Language Server",
@@ -4426,9 +4652,9 @@ var VueServer = {
   clientWaitTimeoutMs: 3e4,
   initializeTimeoutMs: 3e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
-    const hasPackageJson = existsSync3(path7.join(root, "package.json"));
-    const hasNodeModules = existsSync3(path7.join(root, "node_modules"));
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
+    const hasPackageJson = existsSync3(path6.join(root, "package.json"));
+    const hasNodeModules = existsSync3(path6.join(root, "node_modules"));
     if (hasPackageJson && !hasNodeModules) {
       logSessionStart(`lsp vue: node_modules missing in ${root} \u2014 Vue navigation may be limited. Run: npm install (or pnpm/yarn install) in this project.`);
     }
@@ -4443,12 +4669,13 @@ var VueServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
 var SvelteServer = {
   id: "svelte",
+  executesProjectCode: true,
   idleEviction: "unmeasured",
   role: "language",
   name: "Svelte Language Server",
@@ -4469,7 +4696,7 @@ var SvelteServer = {
   clientWaitTimeoutMs: 2e4,
   initializeTimeoutMs: 2e4,
   async spawn(root, options) {
-    const tsserverPath = await findTsserverPath(root, options?.allowInstall);
+    const tsserverPath = await findTsserverPath(root, options?.allowInstall, options);
     const proc = await resolveAndLaunch({
       candidates: [
         ...nodeBinCandidates(root, "svelteserver"),
@@ -4484,7 +4711,7 @@ var SvelteServer = {
     return {
       process: proc.process,
       source: proc.source,
-      initialization: tsserverPath ? { typescript: { tsdk: path7.dirname(tsserverPath) } } : void 0
+      initialization: tsserverPath ? { typescript: { tsdk: path6.dirname(tsserverPath) } } : void 0
     };
   }
 };
@@ -4735,6 +4962,7 @@ var LSP_SERVERS = [
   FSharpServer,
   JavaServer,
   KotlinServer,
+  LeanServer,
   SwiftServer,
   DartServer,
   LuaServer,
@@ -4777,6 +5005,54 @@ function getServerById(id) {
   return LSP_SERVERS.find((server) => server.id === id);
 }
 
+// dist/clients/lsp/session-roots.js
+import path7 from "node:path";
+var SESSION_ROOT_CAP = 128;
+var sessionRoots = new BoundedFifoMap(SESSION_ROOT_CAP);
+function noteEvictedRoots(evicted) {
+  const roots = evicted.map(([root]) => root);
+  if (roots.length > 0) {
+    incrementDegradationCount({
+      kind: "lsp-session-root-evicted",
+      subject: `cap=${SESSION_ROOT_CAP}`,
+      reason: `session root registry at capacity; will load the dropped root again on the next session start or tool call naming it (dropped: ${roots[0]})`
+    });
+  }
+  return roots;
+}
+function registerSessionRoot(cwd) {
+  const root = path7.resolve(cwd);
+  if (sessionRoots.has(root))
+    return [];
+  return noteEvictedRoots(sessionRoots.set(root, void 0));
+}
+function setSessionRootConfig(cwd, config) {
+  return noteEvictedRoots(sessionRoots.set(path7.resolve(cwd), config));
+}
+function sessionRootConfigEntries() {
+  return sessionRoots;
+}
+function isSessionRootRegistered(cwd) {
+  return sessionRoots.has(path7.resolve(cwd));
+}
+function shouldInitializeSessionRoot(cwd, readyRoots) {
+  const normalized = path7.resolve(cwd);
+  return !readyRoots.has(normalized) || !isSessionRootRegistered(normalized);
+}
+function isOutsideAllSessionRoots(filePath) {
+  if (sessionRoots.size === 0)
+    return false;
+  const resolved = path7.resolve(filePath);
+  for (const root of sessionRoots.keys()) {
+    if (isSameOrWithin(root, resolved))
+      return false;
+  }
+  return true;
+}
+function getSessionRootsForTelemetry(limit = 4) {
+  return [...sessionRoots.keys()].sort((a, b) => Number(a > b) - Number(a < b)).slice(0, limit);
+}
+
 export {
   findLocalTyposConfig,
   getAstGrepRuleSources,
@@ -4784,6 +5060,8 @@ export {
   isAuxiliary,
   serverTraits,
   registerRunnerId,
+  withLspProjectCodePermission,
+  refuseUntrustedLspExecution,
   BUILTIN_SERVER_RUNNER_COVERS,
   describeRootFallback,
   resolveLspServerCwd,